Law No. 124/2024 and data transfers from Albania to Türkiye
Law No. 124/2024 'On the protection of personal data' was published in the Official Gazette on 17 January 2025 and has been in force since 1 February 2025, enforced by the Commissioner for the Right to Information and the Protection of Personal Data (idp.al). Annex 1 of the Commissioner's Decision No. 01 of 30 April 2025 lists the countries treated as adequate for transfers out of Albania, including EU and EEA states, the UK, Switzerland, Kosovo, Serbia, North Macedonia, Montenegro and Japan. Türkiye is not on it. Work that sends your users' personal data to engineers in Ankara therefore relies on appropriate safeguards, such as contractual clauses, or one of the exceptions in Article 41. The practical order is to keep personal data out of development environments where possible and sign the clauses before anyone gets production access. The rules on mandatory DPIAs and on notifying data subjects of breaches were deferred and take effect in early 2027, so they are worth designing for now.





